Re: [PATCH v6 45/60] i386/tdx: Don't get/put guest state for TDX VMs

[Paolo Bonzini]

On 11/5/24 12:25, Xiaoyao Li wrote:
> On 11/5/2024 5:55 PM, Paolo Bonzini wrote:
> > On 11/5/24 07:23, Xiaoyao Li wrote:
> > > From: Sean Christopherson <sean.j.christopherson@intel.com>
> > >
> > > Don't get/put state of TDX VMs since accessing/mutating guest state of
> > > production TDs is not supported.
> > >
> > > Note, it will be allowed for a debug TD. Corresponding support will be
> > > introduced when debug TD support is implemented in the future.
> > >
> > > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> > > Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
> > > Acked-by: Gerd Hoffmann <kraxel@redhat.com>
> >
> > This should be unnecessary now that QEMU has 
> > kvm_mark_guest_state_protected().
>
> Reverting this patch, we get:
>
> tdx: tdx: error: failed to set MSR 0x174 to 0x0
> tdx: ../../../go/src/tdx/tdx-qemu/target/i386/kvm/kvm.c:3859: 
> kvm_buf_set_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
> error: failed to set MSR 0x174 to 0x0
> tdx: ../../../go/src/tdx/tdx-qemu/target/i386/kvm/kvm.c:3859: 
> kvm_buf_set_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
Difficult to "debug" without even a backtrace, but you might be calling 
kvm_mark_guest_state_protected() too late.  For SNP, the entry values of 
the registers are customizable, for TDX they're not.  So for TDX I think 
it should be called even before realize completes, whereas SNP only 
calls it on the first transition to RUNNING.

Paolo